
Abstract Binary code similarity detection (BCSD) poses a significant threat to software security by enabling reverse engineers to identify critical functions in binaries. Code obfuscation is a primary defense, yet existing techniques often incur high performance overhead and introduce recognizable patterns. To address these limitations, we present FunSp, a lightweight code obfuscation method based on function splitting at the compiler intermediate representation level. FunSp partitions a function’s control flow graph into multiple subgraphs via dominator-tree analysis, repairs inter-subgraph data dependencies, reconstructs control flow, and finally rewrites the code to produce semantically equivalent sub-functions. This approach redistributes basic blocks across subfunctions without injecting substantial redundant code, thereby minimizing overhead. Experimental results show that FunSp effectively undermines state-of-the-art BCSD models, reducing Recall@1 to 0.016 in a 10 000-function pool. It maintains practicality, introducing a mean code expansion ratio of 1.353 $\times $ and a runtime overhead of 12.7%. Compared with Obfuscator-LLVM and Tigress, FunSp reduces code bloat by 73.5% and runtime overhead by 5.5%.
| selected citations These citations are derived from selected sources. This is an alternative to the "Influence" indicator, which also reflects the overall/total impact of an article in the research community at large, based on the underlying citation network (diachronically). | 0 | |
| popularity This indicator reflects the "current" impact/attention (the "hype") of an article in the research community at large, based on the underlying citation network. | Average | |
| influence This indicator reflects the overall/total impact of an article in the research community at large, based on the underlying citation network (diachronically). | Average | |
| impulse This indicator reflects the initial momentum of an article directly after its publication, based on the underlying citation network. | Average |
